Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 23 2026
Transcript
- Jerry: If you're running Checkpoint Smart Console and the management IP is reachable from the internet, you've got some work to do. This is the Daily DefSec Brief. I'm Jerry Bell, the day's daily security news in five minutes for Thursday, July 23rd, 2026. First up, there's an actively exploited authentication bypass in Checkpoint Smart Console that lets an unauthenticated attacker grab a login token and authenticate as a full administrator. Then modify security policies on the management server. Patch immediately, and if you can't patch today, restrict trusted clients to known admin IPs and take that management interface off the public internet. Two, Cisco Talus is a write-up on a Rust-based rat tied to the Chaos Ransomware Group that routes all its command and control traffic through a headless Chrome or Edge instance using WebRTC. So the only traffic leaving the endpoint looks like it's coming from a legitimate browser process. Hunt for Chrome.exe or msedge.exe spawned by non-user processes, anomalous WebRTC or stun traffic, and unusual Chrome DevTools protocol activity on LoopEck. Pull Talos' IOC list as well. 3. CISA and the FBI have updated their April advisory on Iranian-linked OT attacks to add Siemens and Schneider Electric to the confirmed targeted list alongside Rockwell. Attackers are using legitimate PLC programming software over the internet to alter control logic and manipulate HMI and SCADA displays at energy, water, and government facilities. Take all PLC management interfaces off the public internet now. Audit project files for unauthorized changes and check for inbound connections from foreign leased infrastructure. Qualis published a public proof of concept for CVE 2026 64600 dub reflux FS. A Linux kernel bug in XFS that lets an unprivileged local user overwrite root-owned files at the block layer, And the overwrite survives a reboot with set UID bits intact. Apply your distro vendors, backported kernel patches, prioritize internet facing and multi-tenant Linux systems. Five. Also from Qualas, erase condition in Ubuntu's Snapconfined Sandbox Setup Tool lets an unprivileged local user get full route on default Ubuntu desktop installs. Twenty-four.04, 25.10, and 26.04 are affected. Apply updated Snapd packages from Canonical when they're available, and in the meantime, restrict local user access to sensitive Ubuntu systems. Six Guardio Labs found a cross origin disclosure flaw in the Adobe Acrobat Chrome extension with about 329 million installs that lets any malicious web page silently read WhatsApp web conversations and contacts just by getting a user to visit it. It was patched in June, but confirmed that the extension is auto-updated past version 26.5.2.2. And force the update if auto update is disabled in your environment. 7. A heads up that GeoServer CVE 2024 36401 an unauthenticated remote code execution flaw from 2024 is still showing up in honeypot logs this week, with attackers pulling droppers via Wget and Curl. If you've got unpatched GeoServer instances exposed to the internet, you know what to do. Eight, a self-propagating worm called Sandworm Mode is spreading through malicious MPM packages and targeting CI pipelines and AI coding tool chains. It's designed to look like routine developer automation, which is what makes it hard to catch. Audit MPM dependencies for packages in the Sandworm Mode family, lockdown CI pipeline permissions to lease privilege, and review your AI coding assistant plugin sources. CrowdStrike and socket security both have IOC lists. 9. Search CC disclosed that duplicati version 2.3.0.1 on Windows is vulnerable to DLL planting if it's installed outside of the program files directory. A low privileged user can drop malicious DLLs and get it executed in Duplicati's context. Reinstall to the default program files path or upgrade to the latest fixed version. and audit any non-standard deployments. 10. PyPy has blocked new file uploads to releases older than 14 days. closing a window where a compromised token could silently inject malicious files into a stable trusted release. No action is required for most users Maintainers should know the window is now 14 days and treat any upload attempted after that as a potential indicator of compromise. 11. Researchers are presenting at Black Hat next week on exploitable flaws in how Microsoft handles pass keys, showing the implementation gaps in the relying party still matter even when the underlying credential is phishing resistant. Review the disclosure when it drops. And don't treat a pass cube rollout as a complete identity hardening measure without validating the implementation. 12. A University of Texas study looked at 1646 open source CVEs with multiple patch commits and found the flaw often stays live until the last commit lands. The practical takeaway is that for any multi-patch CVE, confirm that you've applied every commit in the fix, not just the first one, the NVD entry links. That's the board for today. Thank you for watching. Sources and CVEs are in the show notes below. If this was useful, give us a like and subscribe. And if you know someone who gue a daily five minute security brief, send it their way. Back again tomorrow.